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EXECUTIVE SUMMARY 

Reduced crew operations (RCO) refers to the reduction of crew members flying long-haul or military 
operations with more than one pilot onboard. Single pilot operations (SPO) refers to flying a 
commercial transport aircraft with only one pilot on board the aircraft, assisted by advanced onboard 
automation and/or ground operators providing piloting support services. Properly implemented, 
RCO/SPO could provide operating cost savings while maintaining a level of safety no less than 
conventional two-pilot commercial operations. A concept of operations (ConOps) for any paradigm 
describes the characteristics of its various components and their integration in a multi-dimensional 
design space. This paper presents key options for human/automation function allocation being 
considered by NASA in its ongoing development of RCO/SPO ConOps. 


1. INTRODUCTION 

Many aircraft, such as small private airplanes or military fighters, are operated with a single pilot in the 
cockpit. Although commercial aircraft can be operated by a single pilot from either of the two-pilot 
seats, U.S. federal aviation regulations (FAR 121.385) currently requires a cockpit crew of at least two 
pilots for most commercial air carriers’. The cost associated with crews (salaries, benefits, training, etc.) 
is a significant fraction of the aircraft operating cost, especially for regional/commuter operators that 
typically fly smaller aircraft with fewer seats than major airline operators that fly narrow/wide-body 
aircraft. Additionally, current trends indicate a possible shortage of available pilots in the future (USA 
Today, 2013). Crew cost and availability issues provide the motivation to explore the feasibility of 
safely operating long-haul and military operations with a reduced crew, and commercial aircraft with a 
single pilot in the cockpit assisted by advanced onboard automation and ground operators providing 
flight support services well beyond those currently delivered by aircraft dispatchers. 


These paradigms are termed Reduced Crew Operations (RCO) and Single Pilot Operations (SPO), 
respectively. A key requirement of RCO/SPO is to maintain safety at a level no less than current two- 
pilot operations by the introduction of advanced cockpit automation and possibly new ground operator 
positions using support tools and air-ground communication links. The major emphasis is placed on 
SPO in this ConOps paper because SPO poses more unique challenges than RCO, making its analysis 
more critical. SPO, in particular, will yield economic benefits if the costs of new ground operators and 
advanced automation are surpassed by the savings from a ~50% reduction in cockpit crew costs. In 
addition to the primary cost savings arising from eliminating the first officer position, there will likely 


' FAR Sec. 121.385 (c) The minimum pilot crew is two pilots and the certificate holder shall designate one pilot as pilot in 
command and the other second in command. 
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be secondary savings for SPO due to better crew connection integrity and smaller/lighter cockpits in 
next-generation commercial aircraft designed for single-pilot operations. 


NASA is conducting research on SPO feasibility under its Airspace Systems Program (Warwick, 2013). 
Some aspects of SPO are also being researched in Europe under the Advanced Cockpit for Reduction Of 
Stress and Workload (ACROSS) program (ACROSS, 2014). An important element of NASA’s SPO 
research is the development of a concept of operations (ConOps) that covers the roles and 
responsibilities of the principal human operators, the automation tools used by the humans, and the 
operating procedures for human-human and human-automation interactions. This ConOps is being 
constructed using insights gained from a variety of sources including subject matter experts, human-in- 
the-loop experiments examining key aspects of the ConOps, and cost-benefit analyses. 


This paper presents key options for human/automation function allocation being considered by NASA in 
its ongoing development of a SPO ConOps. It is beyond the scope of this paper to explore all options in 
the ConOps design space. The options presented here were selected by the research team based on 
insights drawn from subject matter experts participating in an SPO technical exchange meeting 
(Comerford et al., 2013) and knowledge gained from initial human-in-the loop experiments studying 
specific aspects of SPO (Lachter, Battiste, et al., 2014; Lachter, Brandt, et al., 2014). Section 2 provides 
a brief history of the evolution from a five-person cockpit to the current two-person cockpit, and outlines 
some implications of one-person cockpit operations. Section 3 presents a taxonomy of operating 
conditions for SPO, to establish high level requirements for operator functions and equipment. Section 4 
presents key options for function allocation among various types of human operators, while Section 5 
describes considerations for human-automation function allocation. Some concluding remarks are 
presented in Section 6. 


2. COCKPIT CREW COMPLEMENT 

SPO may be regarded as the next phase of a decades-long downward trend in the minimum number of 
cockpit crew required for safe operations. In the 1950s, commercial aircraft typically had five cockpit 
crewmembers: captain, first officer (co-pilot), flight engineer, navigator, and radio operator. Advances 
in voice communication equipment removed the need for a dedicated radio operator position. Next, 
advances in navigation equipment (e.g., inertial navigation systems) removed the need for a dedicated 
navigator position. Finally, advances in r engines, aircraft systems and improved tools for monitoring 
have removed the need for a dedicated flight engineer position. 


Over the past 25 years or so, commercial aircraft have operated with a two-person cockpit (captain and 
first officer). It is important to note that the functions associated with the radio operator, navigator, and 
flight engineer positions did not simply disappear — they are now performed by the captain and/or first 
officer, assisted by cockpit equipment that has greatly reduced the human workload originally required 
to perform those functions. This new equipment along with new flight deck procedures have preserved 
or increased flight safety, even with a reduced crew. Economic benefits have been realized because the 
savings from reduced cockpit crew expenses have exceeded the costs of equipage. 


The transition from a two-pilot cockpit to a single-pilot cockpit will be significantly more challenging 
than the transitions from a five-person cockpit to a two-person cockpit. Unlike the previous transitions, 
it may not be possible to assure safety of SPO simply by adding new automation to the cockpit. There 
will likely be situations where the single pilot in the cockpit needs to collaborate with a person on the 
ground to solve a complex problem. There is also the issue of single-pilot incapacitation, which could 
be addressed by a ground operator directing advanced cockpit automation. 


Implementation of SPO involves a transition from the current paradigm of a Captain, First Officer, and 
Dispatcher team using conventional automation tools, to a new paradigm of a Captain and Ground 
Operator team interacting with advanced human-centered automation tools (see Fig. 2). Although many 
of the functions currently performed by the first officer could be performed by some combination of 
ground operators and advanced automation under SPO, there is an opportunity for a “clean-slate” 
allocation of functions for Captain, Ground Operator, and Automation. This clean-slate approach to 
SPO would result in a new/different model for crew resource management (CRM). 
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Figure 2. Conventional vs. single-pilot operations 


3. TAXONOMY OF OPERATING CONDITIONS FOR SPO 

The characteristics (e.g., roles/responsibilities, tools, procedures) of an SPO ConOps will depend in part 
on the nature of the operating condition. A basic taxonomy is presented in Fig. 3, based on the pilot’s 
physiological and behavioral condition (normal vs. incapacitated) and flight condition (nominal vs. off- 
nominal). It is noted that the term “flight condition” refers to the myriad factors affecting the flight 
other than the pilot’s condition, such as the status of aircraft systems, weather conditions, and airport 
availability. 

As the taxonomy condition (TC) progresses from 1 to 4, the operating conditions become more 
challenging, and the requirements for safe implementation of SPO become more complex. For example, 
in TC-—1, there may not be much need for ground operator assistance; the cockpit automation could 
provide most of the assistance needed by the captain. In TC—2, the captain would likely request the 
assistance of a ground operator, especially in complex off-nominal conditions with high cognitive 
workload. TC—3 would require a ground operator to assume the role of captain and interact with cockpit 
automation to land the aircraft. In TC—-4 the ground operator acting as captain may need assistance from 
other ground operators to land the aircraft. 
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Figure 3. A taxonomy of operating conditions for SPO 


Under SPO, it is assumed that an incapacitated pilot condition would be handled as a declared 
emergency with air traffic control (ATC) providing special handling to the flight which would be 
directed to land by a ground operator interacting with advanced cockpit automation. A study (DeJohn et 
al., 2004) conducted by the FAA Aeromedical Institute for U.S. flights over the six-year period 1993-— 
1998 found 39 instances of in-flight medical incapacitation, defined as a condition in which a flight 
crewmember was unable to perform any flight duties; the in-flight event rate was 0.045 per 100,000 
flying hours. This corresponds, on average, to one incapacitation event per 1.85 months or per 2.2 
million flying hours. Although these statistics may be somewhat different in the SPO implementation 
timeframe, the incapacitation rates would likely be low enough that declaring a pilot-incapacitation 
emergency would not unduly disrupt ATC operations. 


The necessity for safely landing an SPO aircraft with an incapacitated pilot will be a key driver of 
technology requirements for cockpit automation, remote flight-control tools for the ground operator, and 
air/ground data links. The implementation of these technologies with sufficient reliability/redundancy 
will likely represent a significant part of the costs of implementing SPO. It is noted that some 
components of the technologies required for safe landing in an incapacitated-pilot scenario, such as 
autoland systems, are already available and in current use. 


4. FUNCTION ALLOCATION FOR HUMAN OPERATORS 

This section presents considerations for function allocation among the human operators on the aircraft 
and ground. Characteristics of functions performed by the captain and ground operators are described; 
this includes options for organization structures for ground operators. The material presented in this 
section is not intended to be an all-encompassing treatment of RSO/SPO options for function allocation 
among human operators; its scope is limited to the options being considered by NASA in its ongoing 
development of a ConOps for SPO. Function allocation between human operators and automation is 
discussed in Section 5. 
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Currently, communications to the flight deck have a high latency and low bandwidth compared to 
technology that is available in other sectors. This is driven by cost considerations of upgrading and the 
high level of safety that the current system enables. Improvement in latency and bandwidth are being 
seen for passengers, and this is being enabled by the business case of passengers paying for internet 
connection. Future improvements to flight deck communications will be able to take advantage of 
technology developed for passengers and other sectors, but will require infrastructure, including 
security, that may need to be financed through savings resulting from RCO or SPO. 


With ATN mandates being delayed to 2020 and new FANS CPDLC systems being installed at faster 
rate to more platforms, it is likely that ACARS in support of ATC/CPDLC will be used for 20 to 30 
more years. ACARS is not currently protected with a message assurance security system. Pilots can be 
tricked into accepting a counterfeit ATC clearance because there is no authentication or encryption on 
Data Link messages. Security measures such as Protected ACARS (Storck, 2013) will be a necessary 
part of an RCO/SPO solution. 


Given the infrastructure financing, there do not appear to be major technological barriers to high- 
bandwidth, low-latency support to the flight deck in the twenty-year time frame of SPO. One example of 
a part of this infrastructure is OneWeb, which is building a constellation of more than 600 satellites that, 
when launched, will provide approximately 10 terabits per second of low-latency, high-speed broadband 
for aviation (Rockwell Collins, 2015). 


Military Long Haul RCO 


Along the path to single pilot operations we will see a number of reduced crew concepts which will aid 
us (FAA regulators and the flying public) in becoming comfortable with reducing the number of flight 
deck crew on passenger transport aircraft. The first expected change to crew complement will probably 
come from the military, which are not subject to full FAA oversight. A USAF research and development 
contract with Boeing is investigating reduced crew operations for military long haul missions. A concept 
that is being discussed is to reduce the number of crew members for each mission by at least one. In this 
concept the captain and at least two first officers will man each flight. The crew will begin and end all 
flights with all crew members on the flight deck during takeoff and landing. However, during cruise the 
flight deck will be staffed by only one crew member. The other two will be given crew rest periods. 
Based on the length of the mission, flight deck staffing periods will be assigned to each crew member. 
This concept will not require anywhere near the level of automation and procedural changes as will be 
needed for SPO. However, to support this concept some changes in current flight deck procedures will 
be required. Currently, flight deck procedures require that when only one flight crew member is on the 
flight deck that that crew member must don an oxygen mask. To support RCO current flight deck 
requirements and procedures will have to be reexamined. Additionally, new technology to monitor the 
single pilot on the flight deck will have to be developed. Although the crew response to flight crew 
incapacitation will not require the same levels of technology as needed for SPO, this crew state will have 
to be planned for and mitigated. New crew monitoring and alerting techniques will have to be developed 
along with new automation to maintain safety of flight while the resting crew member are alerted and 
return to the cockpit. The development of the technology and procedures needed to support RCO for 
military flight will move us significantly along the path to SPO. An alternative staffing plan which 
keeps two crew members on the flight deck at all times would significantly reduce the need to develop 
pilot monitoring and alerting technology, but also significantly reduce crew rest. 


Civil Long Haul Cargo and Passenger Transport RCO 


The proof of concept for military RCO will provide a road map to both the airlines and the FAA to 
support an implementation of RCO for Civil long haul transport flight operations. With a good handle 
on the crew flight deck procedures, technology requirements and safety standards which will be needed, 
the time needed to certify civil transport RCO operations should be significantly reduced. The business 
case for the airlines is very straight forward; for long haul missions where two complete crews are 
normally required they will be able to reduce the staffing complement by one flight crew member. This 
reduction will translate into a significant savings of 25% on the cost of pilots for each long haul mission. 
Of course there will be needed changes in technology and procedures which will, in the short term 
reduce the benefit, however over the long term this concept will reduce cost while also maintaining 
current levels of safety. 


Civil Cargo SPO 


The next step along our path to SPO for civil passenger transport will be to development or transition of 
UAS technology for ground management of civil transport flight deck. SPO civil cargo operations will 
have one significant advantage over UAS operations, in that a single pilot will remain with the aircraft, 
thus reducing the need for detect and avoid technology. However, one significant effort will be the 
development of human centered flight deck automation which can truly replace the second person on the 
flight deck. Current research on SPO has provided some of the many questions which must be answered 
to achieve civil cargo SPO — replacement of non-verbal cues; tools and displays to support effective 
communication; and a possible architecture which support effective crew interactions. The lessons 
learned from certification and operation of RCO will aid significantly in the move to civil cargo SPO. 
Finally, this step is also aided by the fact that no passenger issues need to be resolved to certify SPO for 
civil cargo operations. 


SPO for Passenger Transport 


The transition from the current two person cockpit to SPO seems a very daunting task with many 
technology, personnel, and procedural issues that will need to be resolved. However, following a path 
from near-term RCO from military and civil long haul, through civil cargo will provide a spiral 
approach to both technology and procedural development. Additionally, using this approach will allow 
the FAA, the airlines and the flying public to assess and gain confidence in the deployed technology and 
the safety of reduced crew and single pilot operations. This engineering, build a little and test a little, 
approach has been found successful on many of NASA airspace and space development and 
implementation projects. The following sections will touch on the crew roles for both RCO and SPO and 
will distinguish between the two only as needed for clarity. 


4.1. Captain 

The captain (unless incapacitated) serves as the pilot-in-command (PIC), making all decisions pertaining 
to command of the flight. As such, he/she bears the ultimate responsibility for safe and efficient 
operation of the flight. The captain is the final decision-maker regarding the flight mission, and 
(according to procedures) calls on automation and ground operator assets to accomplish this mission. 
The captain’s main tasks are to manage risk and resources (both human and automation). Under SPO, 
the fundamental command/leadership role of the captain will not change, but the individual tasks and 
duties of the Captain will change significantly. The captain will likely take on some of the conventional 
Pilot Flying (PF) and Pilot Monitoring (PM) duties, while other PF and PM duties are allocated to the 
automation or the ground operators. The characteristics of the resources available to the captain will 
also be quite different, e.g., no first officer in cockpit, expanded menu of resources available from 
ground operators, new/advanced automation available in the cockpit. With this change in function 
allocation, anew CRM model will likely be required under SPO. 
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Figure 4. Representative layout of airline operations center 


4.2. Ground Operators 

In current operations, flights receive ground support services from their airline operations center (AOC). 
Figure 4 depicts key positions in a typical AOC, which is supervised by an operations manager. There 
are various AOC teams that provide specialized services, e.g., dispatch, ATC coordination, crew 
scheduling, maintenance operations, customer service, and weather operations. It is anticipated that 
SPO would primarily affect the functions of the dispatch operations, with limited impact on other AOC 
services. 


In current operations, each dispatcher serves around 20 aircraft that are in various phases of flight at 
different locations around the country or even the world. By U.S. regulation, the dispatcher shares 
responsibility with the captain for safe operation of the flight. To be certified, dispatchers must have the 
same knowledge of aviation as airline transport pilots; however, they are not required to have equivalent 
flying skills. A significant part of the dispatcher’s duties lies in the pre-flight phase, where the 
dispatcher consults with the captain and uses various AOC tools to develop a flight plan (e.g., routing, 
cruise altitude, airspeed), determine fuel loading, meet weight and balance requirements, and ensure 
compliance with the minimum equipment list (MEL). After the dispatcher and captain sign the flight 
release, the dispatch functions transition to flight monitoring and serving as a conduit for information 
between the aircraft and other AOC operations. The dispatcher also plays an active role supporting the 
cockpit crew during off-nominal conditions such as aircraft equipment malfunctions, diversions to a 
different destination airport, and large (> 100 nmi) changes in routing. Dispatchers generally serve their 
flights all the way from pre-flight planning to gate arrival. 


In SPO, certified dispatchers become ground operators (see Fig. 4) who collectively perform 
conventional dispatch functions as well as piloting support functions, although each ground operator 
may not necessarily perform both functions. Ground operator teams will collectively perform the 
following three core functions: (1) Conventional Dispatch of multiple aircraft; (2) Distributed Piloting 
support of multiple nominal aircraft; (3) Dedicated Piloting support of a single off-nominal aircraft. The 
Conventional Dispatch function has been described above. 


The Distributed Piloting function corresponds to basic/routine piloting support tasks such as reading a 
checklist, conducting cross-checks, diagnosing an aircraft system caution light, determining the fuel 
consequences of a holding instruction, etc. It is presumed that a single ground operator can provide such 
services to multiple aircraft because these non-urgent and relatively brief tasks can be prioritized and 
executed sequentially, and that little or no specialized training would be required if the distributed 
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piloting function was performed by a dispatcher who has been certified for the aircraft type. This 
function would be applicable only to nominal aircraft, corresponding to Taxonomy Condition | defined 
in Fig. 3. 

The Dedicated Piloting function corresponds to sustained one-on-one piloting support requested by the 
captain under high-workload or challenging off-nominal operating conditions such as an engine fire, 
cabin depressurization, or diversion to an alternate airport due to low fuel and/or bad weather, etc. This 
function is also applicable to situations where the ground operator has to take command of an aircraft 
whose captain has become incapacitated. The tasks associated with this function may include flying the 
aircraft, e.g., remote manipulation of the aircraft’s flight management system (FMS) for route 
amendments, or remote manipulation of the aircraft’s mode control panel (MCP) for sending 
speed/altitude/heading commands to the autopilot. The Dedicated Piloting function would be applicable 
to Taxonomy Conditions 2, 3, and 4 defined in Fig. 3. The skills and training required to perform the 
dedicated piloting support function are essentially the same as those of a conventional pilot. One 
possibility is a rotating schedule where a pilot is scheduled for several weeks of airborne (cockpit) 
assignments followed by a week of ground (AOC) assignments. However, depending on the ground 
operator unit structure employed (see Figure 5 and sections 4.3.1 and 4.2.2), the pilot may need 
additional training in dispatch operations. 


Ground operators will require tools similar to those on the flight deck for issuing high-level flight 
control commands such as making route changes in the aircraft FMS, or manipulating 
airspeed/altitude/heading commands via the MCP. The ground operator tool set may also include next- 
generation dispatcher tools to reduce workload. Additionally, SPO will require a secure and reliable air- 
ground link for voice and data communications. These requirements are similar to those currently being 
considered for unmanned aircraft systems (UAS) operations in the national airspace system. 


There are many possible structures for organizing ground operators to perform the three core functions 
described above. While safe operation is the paramount concern, another key consideration is the 
operating cost associated with the ground operator team structure. One cost factor is the number of 
ground operators relative to the number of aircraft they can safely support, as well as the 
training/qualification requirements for those ground operators. Another cost factor is the number of 
ground stations that require complex and reliable (and hence expensive) equipment such as that required 
to remotely control an aircraft’s flight-path. Cost/complexity of the ground operator support system can 
be traded off against cost/complexity of the cockpit automation support system (this will be discussed in 
Section 5). Two ground operator organization structures of interest, hybrid ground operator unit and 
specialist ground operator unit, are described below and illustrated in Fig. 5. These ground operator 
organization structures have been selected by NASA, based on subject matter expert opinion, for 
evaluation in an upcoming human-in-the-loop evaluation. 


4.2.1. Hybrid Ground Operator Unit 

In this organizational unit, each hybrid ground operator (HGO) is trained and certified to perform all 
three core functions: Conventional Dispatch tasks as well as Distributed Piloting and Dedicated Piloting 
support tasks. 


Each HGO generally serves multiple flights from pre-flight planning to gate arrival. However, if/when 
one of these flights encounters an off-nominal condition that requires dedicated support, the other 
aircraft are handed off to several other HGOs under the direction of the unit’s supervisor. These 
handoffs will require some briefing given that most dispatch operators monitor and aircraft from 
preplanning to gate arrival. A more extensive briefing will be required if the involved aircraft needs 
special handling instructions. The HGO then provides one-on-one support to the off-nominal aircraft, 
calling upon other AOC positions (e.g., maintenance advisors) as necessary. After the off-nominal 
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situation is satisfactorily resolved, the aircraft previously handed off by this HGO are returned to 
him/her if they have not already landed. 
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Figure 5. Examples of ground operator unit structures 


4.2.2. Specialist Ground Operator Unit 

In this organizational unit, there are two types of members. Ground Associates (GAs) are trained and 
certified to perform tasks associated with Conventional Dispatch and Distributed Piloting support for 
nominal aircraft. Ground Pilots (GPs) are trained and certified to perform tasks associated with 
Dedicated Piloting support for off-nominal aircraft. There would be many more GAs than GPs in these 
units. 


Each GA generally serves multiple flights from pre-flight planning to gate arrival. However, if/when one 
of these flights encounters an off-nominal condition that requires dedicated support that aircraft is 
handed off to a GP identified by a supervisor. Prior to the handoff, the GP may be on standby or 
performing collateral duties and would need a handoff briefing from the GA who was serving the off- 
nominal aircraft. The GP provides one-on-one support to the off-nominal aircraft. The GA maintains 
general situational awareness of the off-nominal flight in case the GP requires dispatch support or any 
other AOC support. After the off-nominal situation is satisfactorily resolved, the GP returns the aircraft 
(if it has not already landed) back to the GA. 


4.2.3. Harbor Pilot 

A harbor pilot is a type of ground operator serving as a member of a hybrid unit or a specialist unit (or 
any other type of ground operator unit). The function of a harbor pilot is similar to current practice in 
maritime operations. For example, there could be a harbor pilot with comprehensive knowledge of the 
Metroplex airspace around the New York City airports. Each harbor pilot provides distributed piloting 
support to individual nominal aircraft as they climb and descend through a complex terminal area 
airspace. This could reduce the workload of other positions in the ground operator units, enabling each 
position to support more aircraft. 
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Use Cases 


TC1 Normal/Normal Use Case: Normal arrival or departure at high density HUB airport (i.e., a 
Harbor Pilot ConOp): 


This example case describes an arrival flight into Chicago O’hare (ORD) airport with a harbor pilot. 
The harbor pilot role refers to a ground pilot at a ground control station who can virtually “join” the 
Captain in the cockpit using advanced tools for communication. At approximately 100nm before the top 
of descent, the harbor pilot will contact the captain of an arriving aircraft (called SPO1 for this use case), 
as expected, and will introduce him/herself. Before contacting the Captain of SPO1, the harbor pilot will 
become familiar with the current status of SPO1 by reviewing the aircraft displays via the ground 
control station. After the introduction, the captain will brief the harbor pilot on his/her plan for the 
arrival and assign flight management duties (i.e., pilot flying and pilot monitoring duties typically 
assigned in current operations). The harbor pilot will then brief the arrival and current ATC operations 
for ORD. Normal flight duties for the harbor pilot will be to assume pilot monitoring role for the 
remainder of the flight. Thus, the harbor pilot will manage communications and CDU inputs for the 
flight while the captain will continue to manage all direct flight inputs - MCP, throttles, etc.). The two 
person crew will safely and efficiently manage all elements of the arrival and landing including taxiing 
the aircraft to the gate where the harbor pilot will verify with the captain that his services are no longer 
needed. After being released the harbor pilot will be “returned” and available to assist other arriving 
flights. 


A second example is provided for this condition using a Departure flight from Chicago O’ Hare (ORD). 


For departures the harbor pilot will virtually “virtually join” the captain for the dispatcher flight briefing. 
The captain along with the harbor pilot will receive a dispatch briefing on their flight and any systems 
issues that are included. After the dispatcher’s briefing, the harbor pilot will brief the captain on current 
airport and taxi operations since her last flight. The captain and the harbor pilot will brief the departure 
and flight operations through arrival at cruise altitude. The captain will assign flight duties for the 
departure - normally the harbor pilot will assume the role of pilot monitoring. However this assignment 
is totally at the captain’s discretion. After the briefing the captain, being the only pilot onboard the 
aircraft, will conduct the walk-around while the harbor pilot enters and verifies information in the flight 
computers and request push -back and taxi instructions. The captain and harbor pilot will brief the taxi 
and departure operations. The flight departs normally and after arriving at cruise altitude, the harbor 
pilot will normally bid the -captain a safe flight and sign off the flight. 


TC-2 Normal/ Off-Nominal Use Case: Off-nominal weather event -Airport closed due to weather 


Ground dispatcher contacts SPO1 200nm from destination and advises that its current arrival destination 
is closed due to weather. The captain requests dedicated support from a ground pilot to replan the route 
to the nearest open destination which can accommodate the flight and passengers. For the Hybrid 
Ground Operator Unit, the dispatcher is a certified Ground pilot and hands off all other flights to the 
supervisor who assigns them to other HGOs. The dedicated HGO introduces herself as new ground first 
officer (GFO) for SPO1. For the Specialist Ground Operator Unit, the Ground Associate hands off 
SPO1 to a Dedicated Ground Pilot. 


The Captain briefs any special needs for the flight and assigns the ground pilot the pilot monitoring task. 
The GFO consults the ELP for airports in the area which can accommodate their flight and advises the 
captain of the ELP suggested airport. They both concur on the choice and agree to the change. The GFO 
calls ATC and request ELP routing to new destination. ATC clears flight as requested and GFO loads 
routing into FMS. Captain and GRO concur on routing and are now 100nm from new destination and 
begin arrival briefing. Flight lands at new destination and taxies to the gate. During arrival GFO 
coordinates new destination with ground dispatch to manage passenger handling and advises the captain 
who briefs passengers. 


Another example is provided for an off-nominal system problem of low fuel pressure light. In this 
scenario, the captain calls dispatch and reports a fuel system problem. She also requests dedicated 
support. Dispatch concurs with reported problem, based on information from his ground station which 
shows the same problem based on downlinked telemetry data. The ground dispatcher, and certified 
ground pilot, hands off the other flights to another ground dispatcher and introduces himself as new 
GFO for the flight. The captain briefs current state of the flight and fuel system problem. The captain 
assigns the pilot flying role to the GFO and also suggest that he handles all flight deck task while he 
diagnoses the fuel system problem. The captain runs the fuel system checklist, but they are unable to 
resolve the problem. Captain works with GFO and they agree that the flight needs to land short of their 
destination. The GFO consults ELP for airports in the area which can accommodate their flight. The 
GFO advises the captain of ELP suggested airport; they concur on the choice and agree to the change. 
The GFO calls ATC, declares an emergency and request ELP routing to new destination. ATC clears 
flight as requested and GFO loads routing into FMS. They concur on routing and are now 100nm from 
new destination and begin arrival briefing. Flight lands at new destination and taxies to the gate. 


TC3 Incapacitated Pilot/Systems Normal Use Case: Incapacitated pilot during enroute flight with 
all aircraft systems being normal 


For this TC3 and TC4, separate scenarios are provided for the RCO and SPO context due to the critical 
issue of pilot incapacitation. 


RCO: Onboard sensors (passive and active) detects possible pilot incapacitation. The active sensor 
request a response from the pilot which it does not receive. The onboard automation confirms that the 
aircraft is in a stable flight mode and also alerts (aural horn and flashing lights) the resting crew 
member(s) to the possible pilot incapacitation. Onboard crew member(s) immediately return to the flight 
deck and take control of the aircraft. After verifying aircraft state the crew attends to the pilot who is 
unresponsive to crew input/questions. Since no medical care is available the aircraft is diverted and 
lands at the nearest suitable airport with medical facilities. 


SPO (gradual incapacitation): Ground dispatch receives an alert message on the ACL suggesting that the 
pilot of SPOIL is not feeling well. Ground dispatch makes verbal contact with the pilot and the pilot 
indicates that she may have a mild case of food poisoning. Ground dispatch checks and besides report 
of feeling sick, the physiological readings for the captain (e.g., heart rate, blood pressure) are within 
normal range. The flight seems to be proceeding normally toward their destination for the next 30 
minutes. Then, an alert message appears on the ACL indicating that vomiting was detected from the 
cameras. Dispatch contacts the captain and receives no answer. Dispatcher contacts the onboard flight 
steward to determine if the captain has left the cockpit. The steward answered no and indicated that he 
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was unable to make contact with the captain. Then, another alert on the ACL appears indicating that 
expected pilot inputs at that phase of flight have not been detected. The dispatcher concludes that the 
pilot is incapacitated. The ground dispatch hands off all other flights and, being a certified ground pilot, 
assumes role of captain of SPO1. The Ground Pilot asks the flight steward to check up on the pilot. 
Unable to open the cockpit door from the outside, the flight steward requests the Ground Pilot to open 
the cockpit doors from the GCS. The flight steward opens the cockpit and finds the captain to be 
nonresponsive. With assistance of other flight attendants, they help the pilot to the main cabin and 
contact Ground Pilot to lock the cockpit door. With the onboard pilot now receiving medical attention 
and all systems being normal, the Ground Pilot of SPO1 decides to continue to their destination airport 
and advises ATC of the state of the flight but does not declare an emergency and that no special 
handling will be required. The flight proceeds to destination without further incident and lands and taxis 
to the gate. 


SPO (sudden incapacitation): Ground dispatch receives an alert message on ACL suggesting that the 
pilot of SOP1 is incapacitated; physiological readings for captain are outside of normal range. Ground 
dispatch tries to contact captain and is unable to make contact. The flight seems to be proceeding 
normally toward their destination. Dispatcher contacts onboard flight steward who also was unable to 
make contact with the captain. Flight steward opens the cockpit and finds the captain to be non- 
responsive. The ground dispatch hands off all other flights and assumes role of captain of SPO1 given 
that she is a certified ground pilot. With the captain now receiving medical attention and all systems 
being normal, the Ground Pilot of SPO1 decides to continue to their destination airport and advises ATC 
of the state of the flight but does not declare an emergency and that no special handling will be required. 
The flight proceeds to destination without further incidence and lands and taxis to the gate. 


TC4 Incapacitate Pilot/No Radios Use Case: Incapacitated pilot with lost link 


RCO: Onboard sensors (passive and active) detect possible pilot incapacitation. The active sensor 
requests a response from the pilot which it does not receive. The onboard automation confirms that the 
aircraft is in a stable flight mode and also alerts (aural horn and flashing lights) the resting crew 
member(s) to the possible pilot incapacitation. Onboard crew member(s) immediately return to the flight 
deck and take control of the aircraft. After verifying aircraft state the crew attends to the pilot who is 
unresponsive to crew input/questions. The crew attempts to contact ATC and company but are unable 
due to problems with the radio. The crew sets transponder to 7600 (no radio) followed by 7700 
(emergency). Since no medical care is available the aircraft is diverted to the nearest suitable airport 
with medical facilities. ATC being aware of the aircraft emergency provides priority service to the 
aircraft and it lands without incident. 


SPO: Ground dispatcher receives an alert that no data is being received from SPO1. All telemetry link 
with other aircraft are normal at this time. Dispatcher tries all other forms of communication with the 
aircraft which all fail. During this time he reports possible lost link to ATC, providing standard 
emergency information - fuel, sob, etc.). Both dispatcher and ATC notice that the aircraft has changed 
beacon code to squawk 7600 no radio and 7700 emergency. Unknown to both ATC and ground 
dispatch, the captain has become incapacitated. The status of both the captain and communication link 
have been detected by onboard automation, which was responsible for the changes in beacon codes. 
Automation only, is now in charge of the flight. Contingency management software which is installed 
on all SPO flights, informs the chief Steward on the flight, consults ELP for nearest suitable airport and 
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loads new routing into FMS. The aircraft, still with autoflight systems engaged, proceeds to new 
destination airport. On the ground the flight dispatcher also consults ELP for emergency routing and 
based on results is able to correlate aircraft’ new track with ELP suggested route. The dispatcher 
communicates new projected routing to ATC who is managing the emergency flight. The onboard 
automation combines ELP routing information with autoflight technology to conduct the en route 
descent and arrival into the selected airport. ATC has advised all participating ATC facilities the aircraft 
is an emergency and no radio; all provide priority handling of the flight. The aircraft lands and stops on 
the runway. Now in cell phone contact the chief steward informs dispatch and crew support that the 
captain has been incapacitated for the last 300nm of the flight. Ground support personnel manage 
passenger disembarkation and towing of the aircraft. There was a doctor onboard the flight so the 
captain has been well taken care of and is now conscious. 


5. HUMAN-AUTOMATION FUNCTION ALLOCATION 

This section presents some considerations for allocating functions between human operators and 
automation. First, the cost tradeoffs between automation and human operators are conceptualized. 
Next, some high-level requirements for new cockpit automation are introduced. Finally, some 
observations are made about desired collaboration between human operators and automation. 


5.1. Options Space 

In SPO, the captain (in the cockpit) and ground operators (in an operations support center), working as a 
team, will interact with advanced automation tools (located in the cockpit and at a ground station) to 
maintain flight safety and efficiency. Some of the simpler functions currently performed by a human 
pilot in a two-person cockpit, such as reading checklists and conducting cross-checks, are good 
candidates for automation, although such systems will have to possess some of the same characteristics 
as the operator they are replacing. Highly complex functions, such as formulating options to address 
challenging off-nominal flight conditions, are likely best suited to human cognition given the current 
state of automation sophistication and reliability. Other functions could be performed by humans 
assisted by various levels of automation; some preliminary recommendations are reported in Johnson et 
al. (2012). Higher levels of automation will generally require fewer human ground operators to service 
a given fleet of aircraft. It is likely that there will be a progression, along the SPO implementation 
timeline, from a larger ground operator complement using lower levels of automation to a smaller 
ground operator complement using higher levels of automation. 


Figure 6 is a notional representation of the relationship between the level of automation and the total 
number of operators required to support a fleet of aircraft at a given moment. In conventional 
operations, each aircraft has two pilots, and each dispatcher supports around 20 aircraft, hence a fleet of 
100 aircraft needs a total of about 210operators at a given moment. The cost of operations depends on 
the number and qualifications of the operators as well as the level of automation; therefore the cost of 
conventional operations is notionally proportional to the distance of the blue dot from the origin of the 
axes in Fig. 6. 


The green oval represents the domain of various options for human-automation function allocations for 
SPO. Consider an implementation of SPO, indicated by “A” in Fig. 6, where each first officer is 
replaced by a ground operator. Hence the total number of operators remains the same, and a higher level 
of automation/equipage (e.g., air-ground voice/data links, ground pilot stations) is required. This 
instantiation of SPO has little merit because its implementation cost would likely not provide any 
savings relative to the baseline of conventional operations. Now consider an implementation of SPO, 
indicated by “B” in Fig. 6, where each first officer is effectively replaced by highly advanced cockpit 
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automation (electronic pilot associate). The total number of operators is essentially cut in half, relative 
to the baseline of conventional operations. However, the cost to build such highly sophisticated 
automation would likely be very high and could result in either a cost advantage or disadvantage over 
conventional operations (or might simply be a wash as indicated in Fig. 6). A cost-effective solution is 
indicated by “C” in Fig. 6. Relative to conventional operations, it requires significantly fewer operators 
and significantly more automation, but much less automation than option “B”. Noting that the distance 
from the axes origin is a proxy for cost, it can be seen that the overall operations cost for option “C” is 
lower than that of conventional operations (indicated by the arc in Fig. 6). 


Level of Automation 


Domain of 
Single Pilot 
Operations 


Line length is a @ 
RORY TOL Gost Conventional 
Operations 


Number of Operators 


Figure 6. Options space for implementation of SPO 


The development of an SPO ConOps requires an exploration of the options space outlined above, with 
the goal of identifying an SPO implementation that has characteristics similar to option “C” in Fig. 6. 
For a point of interest in the options space, a key question is: what are the requirements to implement 
this design of SPO at the same level of safety as conventional operations? 


5.2. Cockpit Automation Requirements 

A key requirement for SPO implementation is advanced automation (Schutte et al., 2007) that provides 
onboard support functions at a level well beyond what is currently available in modern commercial 
aircraft. While it may be tempting to simply automate as many of the current pilot functions as possible, 
distancing the captain from the flight/mission could erode situation awareness (SA) and cognitive 
readiness. Over-automation would increase the likelihood of human error and thus handicap the captain. 
Therefore, there may be functions and tasks that could be automated from a technological standpoint, 
but should not be automated in order to maintain the captain’s SA, engagement, and skill retention. 


Some of the cockpit automation capabilities required for SPO already exist, e.g., nearly all modern 
aircraft can fly a preprogrammed route and land with little or no human aid. However, there are two 
important automation capabilities that require significant advancement: (i) interaction and task 
exchange, and, (ii) pilot health monitoring. 


5.2.1. Interaction and Task Exchange 
The capability development required here is to make the automation more of a team player, rather than a 
silent and subservient workhorse. This requires changes in the way the automation interacts with the 
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human, rather than what tasks it performs. For example, cockpit automation needs to clearly inform the 
captain about what it is doing, and to confirm important parameters (e.g., altitude settings). In response 
to a command from the captain, the automation must repeat the command for error-checking, inform the 
captain that it is executing the command, and notify the captain when it is done. In short, the automation 
must follow current best practices for human-to-human CRM. 


The automation will be called upon to assist the captain in declarative, retrospective, and prospective 
memory items. Required tasks of the automation may include checklists, task reminders, challenge-and- 
response protocols, and recall of information or instructions provided by human actors such as ATC 
personnel or ground operators. But these tasks cannot be rigidly prescribed. The human brings certain 
unique capabilities to the cockpit as does the automation. Both types of capabilities are required when 
performing basic interconnected tasks such as: Aviate, Navigate, and Communicate. It may be 
detrimental to assign one task (e.g., Aviate) entirely to the captain and leave the others entirely to 
automation. It is also highly unlikely that the level of automation assistance would remain constant for 
the entire mission; for example, the level of automation will change in the Aviate task, depending on 
whether the captain is manually flying or being assisted in some way by the automation. 


The unique capabilities of the human and the automation may be required at different times. The 
captain and the automation have to be able to hand tasks back and forth between each other in a simple, 
quick, reliable, and well-understood fashion. This reallocation of tasks between them (or between the 
captain, automation and the ground operator) will likely be required in off-nominal or unique situations. 
In these times, workload on the human is already high, and if the captain has to “hand off’ the aircraft to 
the automation in order to deal with a navigation or systems problem, he/she must be able to do so 
quickly and with full confidence. Similarly, if the automation has to hand control back to the captain 
because it is reaching its limitations, it must inform the pilot ahead of time and provide SA information 
to the pilot about why the hand off has become necessary (e.g., with what aspects the automation is 
having difficulty, or is unable to perform.) 


5.2.2. Pilot Health Monitoring 

The second automation capability that requires development is the monitoring of the captain’s 
physiological and behavioral state. This health monitoring serves two purposes: assessing the capacity 
of the captain, and catching mistakes made by the captain. In multi-crew flight decks, the crewmembers 
monitor each other. It is unlikely that automation will advance to the full monitoring capability of a 
human crewmember in the timeframe of SPO implementation, but there are many important health 
factors that could be monitored by the automation. 


Physiological sensors can assess health factors ranging from simple heart rate variability and pulse 
oxygen levels to more elaborate measures such as electro-encephalograms (EEG) and functional near- 
infrared spectroscopy (fNIRS). The challenge here is to make the measurements as non-intrusive and 
comfortable as possible — the idea of wiring the body with multiple sensors is highly undesirable for 
human acceptance. Still, technology continues to advance in remote sensing capability so that no 
physiological measurement should be ruled out at this point. These measurements would provide a 
primary basis for assessing whether the pilot is healthy and responsive. 


Behavioral measures are also important. Monitoring the captain’s actions with regard to instrument and 
inceptor control, communications, and scan patterns is critically important to detect piloting errors and 
to make assessments of cognitive capability. Prescriptive assessments, where the human’s behavior is 
compared to what he/she should be doing at any particular time or after performing a particular task 
(e.g., Task A, then Task B, then Task C), are useful but are often overly rigid and not flexible for real- 
time operations. Another approach is to monitor the human’s actions to ensure that he/she does no 


harm, that is, does not do something that would jeopardize the flight. More than likely, a combination of 
these two methods will be required. 

Pilot health monitoring can also be performed by ground operators who can query the captain or watch a 
video feed of the cockpit to determine the physiological and behavioral state. This assessment, along 
with health monitoring data provided by the automation, will be the basis for a decision to declare the 
captain incapacitated and transfer command authority to ground operators and/or cockpit automation to 
land safely. 


A 2004 FAA report on pilot incapacitation, examining a 5-year period between 1993 and 1998, found 
that the probability that an inflight medical event (i.e., pilot incapacitation) would result in an aircraft 
accident was .04 (see 
http://www.faa.gov/data_research/research/med_humanfacs/oamtechreports/2000s/media/0416.pdf). 
Similarly, an Australian Government report (2007)covering the period of 1975 through March 2006, 
found very low occurrences of pilot incapacitation that led to a reported accident (N = 16) or incident (N 
= 82). In 10 occurrences, though, the outcome of the event was a fatal accident, and all of these 
accidents involved single-pilot operations (see http://www.atsb.gov.au/media/29965/b20060170.pdf). 
Evans and Ratcliffe (2012) indicated that the incapacitation rate in current operations can provide a basis 
for quantifying the acceptable risk of single pilot operations in commercial flight. 


From both reports, the cause of incapacitation can be grouped into four main categories of: loss of 
consciousness, cardiac (e.g., heart attacks), neurological (e.g., seizures), and gastrointestinal (e.g. food 
poisoning). The probability of pilot incapacitation also increases with age (FAA, 2014; Huster, Muller, 
Prohn, Nowak, & Herbig, 2014). 


Research on Pilot incapacitation have examined methods for: Detection of Inactivity (Behavior; 
motion sensors; e.g., Trujillo & Gregory, 2014), Detection on Alertness states and Fatigue (Face 
recognition, eye tracking, behaviors, psychophysiological monitoring for signs of loss of consciousness 
or drowsiness; e.g., Steffin & Wahl, 2003); Detection of high environmental stress and workload 
(psychophysiological monitoring signs of distress; Sledge, 1978). The Table below provides some 
indicators of inactivity, alertness, and illness that can be measured for the monitoring of pilot 
incapacitation. In addition, pilot report of signs of illness or physiological and behavioral indicators of 
potential impairments and incapacitation can be recorded. It should also be noted, that once the pilot is 
declared incapacitated, the plane should not only be transferred safely to another pilot (RCO) or to the 
ground (SPO), but that the pilot receive medical help. This is especially important in SPO if the cockpit 
can only be unlocked from the inside. 


Loss of Cardiac Neuro- Gastro- 


conscious logical intestinal 
ness (seizures) 


Pilot Acknowledgement of not feeling well 
Verbal (headache, stomach pain, chest pain, etc.) x x x 


Action (press button) x x x 


Inactivity 


Muscle tone (stiff/limp) x 


No Response-Actions x x 
(e.g., Langley model) 


No Response- x x 
Communication* 


No Response-Eye tracking (monitoring and cross- x x 
checking of flight instruments) 


Alertness/Fatigue 


Facial Eye (staring, closing, shut) | x 


Facial Mouth x 


(drooling) 


Subjective Report | x 


Irregular EEG activity | x x 


Stress and workload 


Heart Rate | Sudden | x x 
drop 


Blood Pressure | Sudden | x x 
drop 


Sweating x 


Irregular breathing Shortness 
of breath 


| Premature Ventricular Contractions | | x | | | 
1 


(predictive of heart attacks) 
Body temperature | x 


Other Signs of Illness 


Facial Eye (twitching, blinking, rolling) 


Face Mouth (lipsmacking, chewing, swallowing) 


Muscle (jerking or twitching movements) 
Nausea/vomiting x 


Loss of bladder or bowel control 


Reduced blood flow | x 


*Flight crewmembers should be alert to subtle incapacitation: 
e Ifacrewmember does not respond appropriately to two verbal communications, or 
e Ifacrewmember does not respond to a verbal communication associated with a significant 
deviation from a standard flight profile 


5.3. Collaboration 

While it is important to describe the roles of each of the major players in SPO (Captain, Ground 
Operator(s), Automation), it is also important to remember that none of these players acts independently. 
In order for SPO to be feasible, each player must be able to shed and take on tasks and responsibilities 
as/when needed. 


Not only is pilot incapacitation a critical concern, but the prospect of automation failure, and/or 
communications failure must also be addressed. If the automation is malfunctioning (e.g., stuck in a 
mode, erroneous flight data, software bug) or non-functional (e.g., total failure of autopilot, guidance, 
secondary systems), the captain and ground operators should be able to safely land the aircraft and 
perhaps safely complete the mission. Likewise, if the communications network is impaired (e.g., 
decreased bandwidth) or non-functional, the Captain and automation should be able to safely land or 
perhaps even complete the flight as planned. 


This flexibility is not only important in off-nominal conditions, but in nominal conditions as well. One 
example is when the captain has to leave the cockpit for a short break. In such cases, the automation 
will be flying the aircraft; however, the ground operator would be called upon to closely monitor the 
flight (and perform remote piloting functions as necessary) and update the captain on the flight’s status 
when he/she returns to the cockpit. Similarly, the captain may sometimes need to manually fly the 
aircraft; in such cases, some communications, navigation, or systems tasks that the captain might 
normally have performed (e.g., normal checklists) may be temporarily assigned to the automation and/or 
the ground operator. 


6. CONCLUSION 

A framework has been presented for the development of an RCO/SPO ConOps by outlining options for 
key dimensions of the ConOps design space. First, a taxonomy of operating conditions was defined, 
spanning the dimensions of pilot condition and flight condition. Next, function allocation among 
various types of human operators was discussed, as well some candidate structures for ground operator 
units and the nature of services their operator positions would provide to the captain. Then, an options 
space was examined, with dimensions spanning the number of air-ground operators and the level of 
automation; minimizing the total number of operators does not necessarily provide the most cost- 
effective solution. Finally, requirements of advanced cockpit automation were outlined. Taken 
together, the above material sheds light on the roles/responsibilities of the various air and ground 
operator positions as well as the tools required to perform their tasks and collaborate with each other. 


The RCO/SPO ConOps framework presented in this work is being used to guide the design of NASA’s 
human-in-the-loop simulation studies; a recently completed study is reported in Lachter, Brandt, et al. 
(2014) and follow-on studies are in various stages of planning/execution. The results of these 
operational studies, along with cost-benefit analyses, will be used to develop an RCO/SPO ConOps 
meeting the requirements that it be technologically feasible, yield economic benefits, and provide a 
level of safety no less than conventional two-pilot operations. 
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